DaystoPatch

VendorsEdge, Security

SonicWall

SonicWall makes SonicOS firewalls, Secure Mobile Access (SMA 100 and SMA 1000) remote-access appliances, and Email Security and Capture products.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
1 Sep 2026
Incidents on record
7

Response to exploited bugs

84 range 75–94rank 2 of 10

Provisional 4 reviewed zero-days. Not enough yet for a firm grade.

Fixing privately reported bugs

78 range 68–88rank 5 of 20

Provisional 7 private reports, published on 6 dates. Not enough yet for a firm grade.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: B+ (84), provisional, from 4 reviewed zero-days in the last 36 months. Likely range 75 to 94.
  • First fix within a day for all 4 zero-days.
  • Every supported version fixed within a day for all 4 zero-days.
  • First advisory within a day for all 4 zero-days. Its advisory said the bug was being exploited in 3 of 4.
  • Fixing privately reported bugs: B (78), provisional. Median 77 days from private report to fix (7 cases, 3 with a vendor fix date). 2 of 7 took longer than ZDI's 120-day deadline.
  • 2 of 6 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.

Response to exploited bugs: sub-scores

  • Time to first advisory4 of 4 zero-days within a day
    85B+
    4 cases, low confidence, weight 20%
  • Time to first fix4 of 4 zero-days within a day
    85B+
    4 cases, low confidence, weight 40%
  • Time to fix all versions4 of 4 zero-days within a day
    85B+
    4 cases, low confidence, weight 30%
  • OpennessAdvisories available by API and RSS. 4 of 4 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version.
    78B
    7 cases, medium confidence, weight 10%

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 77 days from private report to fix (7 cases, 3 with a vendor fix date)
    78B
    7 cases, low confidence, weight 100%

Response fingerprint

Median of 4 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.

Compressed time scale

Counts toward the response grade 4

  1. 1 Sep 2026SonicWall SMA1000 pre-auth SSRF chained with AMC command injection
  2. 14 Jul 2026SonicWall SMA1000 Work Place SSRF chained with AMC code injection (zero-day)
  3. 17 Dec 2025SonicWall SMA1000 AMC local privilege escalation chained with CVE-2025-23006
  4. 22 Jan 2025SonicWall SMA1000 AMC/CMC pre-auth deserialization RCE (zero-day)
Not graded 3: n-days, unreviewed timelines and end-of-life products
  1. 7 Jan 2025SonicOS SSLVPN authentication bypass enabling session hijackingNot graded: n-day
  2. 4 Dec 2023SonicWall SMA 100 post-authentication OS command injection (2023 bug exploited in 2025)Not graded: n-day
  3. 23 Sep 2021SonicWall SMA 100 management interface command injection (2021 bug exploited in 2025)Not graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

7 in 24 months, 4 with known ransomware use, 57% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
1 Sep 2026SonicWall SMA1000 pre-auth SSRF chained with AMC command injectionCVE-2026-83548, CVE-2026-8354910.00h0h0hFixedCounts toward grade
14 Jul 2026SonicWall SMA1000 Work Place SSRF chained with AMC code injection (zero-day)CVE-2026-15409, CVE-2026-1541010.00h0h0hFixedCounts toward grade
17 Dec 2025SonicWall SMA1000 AMC local privilege escalation chained with CVE-2025-23006CVE-2025-406026.60h0h0hFixedCounts toward grade
22 Jan 2025SonicWall SMA1000 AMC/CMC pre-auth deserialization RCE (zero-day)CVE-2025-230069.80h0h0hFixedCounts toward grade
7 Jan 2025SonicOS SSLVPN authentication bypass enabling session hijackingCVE-2024-53704, CVE-2024-40762, CVE-2024-53705, CVE-2024-537068.20h0h0hFixedNot graded: n-day
4 Dec 2023SonicWall SMA 100 post-authentication OS command injection (2023 bug exploited in 2025)CVE-2023-44221, CVE-2023-59707.20h0h0hFixedNot graded: n-day
23 Sep 2021SonicWall SMA 100 management interface command injection (2021 bug exploited in 2025)CVE-2021-200357.20h0h0hFixedNot graded: n-day

Private reports

Median 77 days, 29% over 120 days, 0 published unpatched

Bugs reported privately to SonicWall by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
15 Oct 2026ZDI-26-770CVE-2026-102257Secure Mobile Access77to vendor fix, 6 Oct 2026Yes
11 Aug 2026ZDI-26-530, ZDI-26-531, ZDI-26-532CVE-2026-66148, CVE-2026-66149, CVE-2026-66150Email Security; GMS Virtual Appliance117to publicationYes
24 Apr 2025ZDI-25-253CVE-2025-32817Connect Tunnel62to vendor fix, 16 Apr 2025Yes
9 Jan 2025ZDI-25-011, ZDI-25-012, ZDI-25-013, ZDI-25-014CVE-2024-40762, CVE-2024-53704, CVE-2024-53705, CVE-2024-53706NSv63to vendor fix, 7 Jan 2025Yes
11 Oct 2024ZDI-24-1335CVE-2024-45315Connect Tunnel240to publicationYes
11 Oct 2024ZDI-24-1334CVE-2024-45316Connect Tunnel241to publicationYes
7 May 2024ZDI-24-420, ZDI-24-421CVE-2024-29010, CVE-2024-29011GMS Virtual Appliance41to publicationYes

Advisories changed after publication

1 shown, 0 without a revision note

  1. SNWLID-2021-0022

    Recorded in the revision history

    created_when: 2021-09-23T21:29:13Z

    CVSS base vector changed from AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H to AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (score 5.5 to 7.2).

    • Severity
    CVSS vector
    BeforeAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
    AfterAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    d Injection Vulnerability published_when: 2021-09-23T21:29:13Z last_updated_when: 2025-04-14T17:58:18Z impact: medium cvss: 5.5 cvss_vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H cvss_version: 3.0 cwe: CWE-78 cve: CVE-2021-20035 cpe: summary: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as

    After

    and Injection Vulnerability published_when: 2021-09-23T21:29:13Z last_updated_when: 2025-04-15T15:50:44Z impact: high cvss: 7.2 cvss_vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss_version: 3.0 cwe: CWE-78 cve: CVE-2021-20035 cpe: summary: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as

    Earlier version captured 15 Apr 2025, 02:02 UTC: archived copyLater version captured 17 Apr 2025, 07:25 UTC: archived copyRecovered from archived copiesSnapshots 0c822d4ed0… and 5d043a71b9…Incident page

Grade history

Response to exploited bugs: score at the end of each month.

Show as a table
MonthScoreGrade
Nov 2025–NR
Dec 2025–NR
Jan 2026–NR
Feb 2026–NR
Mar 2026–NR
Apr 2026–NR
May 2026–NR
Jun 2026–NR
Jul 202682B+
Aug 202682B+
Sep 202684B+
Oct 202684B+

Channels

Get SonicWall's own alerts

What we watch

  • APISonicWall PSIRT JSON API (advisory summary)

See sources and health for when each was last read.